Re: Errors with runcon - RHEL4/refpolicy

["Christopher J. PeBenito" <cpebenito@tresys.com>]

On Mon, 2006-09-25 at 10:09 -0400, Osborn, Justin D. wrote:
>       I'm working on a project to do containment of VMware VMs using
> SELinux policy.  Our system is set up on RHEL4 and I have the
> Reference Policy installed. 
> 
>       We're trying to reuse the VMware policy that was originally
> distributed with the Reference Policy.  Specifically there is a
> per-user-domain template that we modified for our use and instantiate
> from another te file.  The policy compiles and our VMs are properly
> labeled after relabeling.
> 
>      The problem is that when I try to kick off a VM using runcon, I
> get the non-descript "unable to setup security context" error.  The
> command I'm running is: runcon root:system_r:ziplock_vm1_vmware_t
> vmware-cmd start /VMs/foo.vmx.  My bash shell is running as
> root:system_r:unconfined_t.  I added my types to system_r and verified
> with apol.
> 
>      So my questions are:
>      a) Why was the VMware policy renoved from the Reference Policy?

I don't understand the question.  Its in refpolicy, and you said you
were using it...

>      b) What am I missing with the runcon error?  Is there somewhere I
> can look for a more descriptive error message?

It means the setexeccon() failed.  Usually a setexeccon() error means
either the context is invalid or it was denied setexec on the processs.
You're unconfined, so you have setexec, so most likely it is an invalid
context.  Newer versions of runcon have a different message explicitly
saying if the context is invalid.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.